Changelog do MemberPress AI Foundation

Melhoria

• Discount_mode now allows trial-override (in CouponService::create, the create_coupon tool, and the create-coupon ability).
• Two new optional fields, trial_days and trial_amount, are stored as _mepr_coupons_trial_days / _mepr_coupons_trial_amount when the mode is trial-override.
• Write abilities now require mpai_use_mcp_write (and mpai_use_mcp, so write implies read), not the read capability alone.
• Application Password sessions are denied write on the Abilities surface, mirroring the read-only cap enforced on /mcp.
• Breaking change for Abilities clients: write and destructive abilities now preview by default. The dry_run schema default flips from false to true, so a call that omits the flag previews. Pass dry_run: false to execute live. Affects refund-transaction, manage-subscription, create-member, update-member, create-coupon, and create-rule.
• The admin "pause destructive writes" kill switch is now honored on the Abilities surface for refund-transaction and manage-subscription.
• Residual divergences from the /mcp Tools path (per-tool requires_cap parity and the two-step confirmation token) are tracked as follow-ups; the write-capability requirement plus preview-by-default is the safety net in the meantime.

Melhoria

• Schema enums updated to MemberPress's canonical vocabulary: discount_mode: ['standard', 'first-payment'], discount_type: ['percent', 'dollar']. Pre-launch breaking change, legacy 'first' / 'all' / 'flat' values are now rejected at every layer (Tools schema, Abilities API schema, service validation, formatter output).
• When discount_mode is 'first-payment', the service now also writes the per-mode _mepr_coupons_first_payment_discount_* meta keys. Without this, MemberPress core would have read the standard meta keys (which it ignores for first-payment mode) and applied a $0 first-payment discount despite the mode being right.
• CouponFormatter::detail canonicalizes its output on read, legacy 'first'/'all' stored values and any other unrecognized mode coerce to 'standard' (matching MemberPress's runtime fallback). Legacy 'flat' discount_type coerces to 'dollar'. The formatter's output schema now always matches the public enum regardless of what's in the DB.
• Discount_mode === 'first-payment' reads from the _mepr_coupons_first_payment_discount_* meta keys when present so coupons that originated in the WP admin (where the form has separate fields for first-payment discount amount/type) surface the right values via the MCP read API.
• Switched isset →! empty for membership_ids so a wrapper layer defaulting to 0 doesn't end up storing [0] as a valid_products filter (which would silently break the coupon).
• Copy button hover-reveal. The button next to the MCP Server URL on the Setup Wizard's "Existing Setup" panel now collapses to zero width when hidden and expands to its content width on hover, focus, or post-click success state. Uses an inline-flex layout (no fixed pixel padding to mismatch the button's actual width across locales), bounded by a max-width: 160px ceiling so a long localized label can't blow out the URL field. @media (hover: none) keeps the button visible by default on touch…
• Memberpress_refund_transaction now flags a MemberPress-core listing side effect. When the refunded transaction has an associated subscription AND the caller did NOT pass cancel_subscription: true, the response (preview and live) includes a new subscription_listing_may_show_inactive: true flag plus a localized subscription_listing_note explaining that the WP admin Subscriptions list will show the subscription as Active: No (because MemberPress core's "Active" column on that list is computed…

Melhoria

• Reload the AI Settings page after the MCP Settings form is saved. Sibling sub-tabs (Setup Wizard, Connected Clients) are server-rendered once per page load, AJAX-saving an option like the access-level ceiling didn't refresh them, so the wizard kept the stale write-checkbox HTML it had at page-load time even though the new ceiling would have hidden it. Adds a short delay so the "Settings saved" notice registers before the navigation, and closes the whole class of cross-tab stale-state bugs (any…
• Route the "Settings saved. Refreshing..." status message through wp_localize_script. Pre-existing pattern in admin.js is that user-facing strings are hardcoded English; this one new string is properly localized via the mpMcpAdmin global. Issue #27 tracks the broader sweep for the other hardcoded strings in that file.

Melhoria

• App Password sessions are always issued read-only scope at the server, regardless of the user's mpai_use_mcp_write capability. Granular write scopes must go through the wizard, which carries an explicit per-scope grant on the token.
• Revoking an App Password row deletes every WP Application Password for that user via WP_Application_Passwords::delete_all_application_passwords. Revoke confirmation surfaces this with a louder warning because the action affects other REST integrations the user may have running.
• Activity Log entries for App Password calls now show "Application Password: " instead of "Unknown".
• Setting renamed to "Maximum access level for new connections" with help text that makes the ceiling semantics explicit ("Caps the access any new client connection can be issued. Read Only here disables write scopes in the setup wizard and for OAuth client registrations.").
• Wizard step 2 hides write checkboxes entirely when the ceiling is Read Only and shows an explanatory notice.
• Server-side cap via new Auth::cap_scope_to_ceiling applied at four issuance paths: wizard token creation, OAuth /authorize, OAuth /token exchange (re-cap closes a TOCTOU window if the ceiling tightens between authorize and exchange), and OAuth root redirect. A hand-crafted POST that bypasses the hidden wizard UI is still capped down to read.
• The cap delegates to ScopeMatcher::has for the intersection so it respects the existing scope hierarchy and would Just Work if a future UI exposes a granular ceiling (e.g. read + write:members but not write:billing).
• Existing already-issued tokens are NOT retroactively narrowed. The ceiling applies at issuance time only.
• Dry_run parameter removed from every write-tool schema. The polarity flip in Server::handle_tool_call already derived dry_run from execute on every call (client-supplied dry_run was ignored), so the schema entry was a documented-but-non-functional parameter. Non-destructive write tools now advertise only execute (default false = preview); destructive tools advertise neither, they use the two-step confirm token flow as their execute mechanism. delete_member's pattern (no execute, no dry_run…
• Default Access Level radios bind to derived state. Fixes a display bug where the canonical CSV 'read,full' (emitted by Auth::normalize_scope_csv for full-access defaults) left both radios unchecked because the template used direct string equality. Same root cause affected the wizard's write-checkbox pre-state.
• Test_AppPasswordSession (15 tests), sentinel insert/race/revoke contract, scope-pin invariant against legacy DB drift.
• Test_CapScopeToCeiling (16 tests), full / read-only / granular ceilings, whitespace-bypass regression, TOCTOU re-cap on token exchange.
• Test_GetScopeCeiling (6 tests), pins the normalization contract for the canonical getter.
• Suite is now 371 tests / 814 assertions, all green.

Melhoria

• AJAX endpoint mp_mcp_toggle_writes_paused flips the state with audit-log entries (admin.writes_paused / admin.writes_resumed).
• Server-side check in Server::handle_tool_call returns WRITES_PAUSED for any tool whose annotations.destructiveHint is true while the toggle is on.
• Token is bound to (tool_name, canonicalized_args, user_id), any change invalidates. Single-use: deleted on first verify.
• Special-cased: manage_subscription/resume and manage_sub_account/add are non-destructive variants of destructive-annotated tools, so they skip the gate. Unknown actions fail safe (still gated).
• Atomic-when-possible: prefers wp_cache_* over transients when a persistent object cache is available, shrinking the consume-race window.
• Every write tool now defaults to preview unless the call sets execute: true. The polarity flip is server-level, adding a future write tool inherits the safe default automatically.
• Old dry_run=true parameter still respected (back-compat). Schemas updated to advertise execute as the canonical control.
• ScopeMatcher is the single source of truth for scope vocabulary. Token storage is a CSV string; the matcher handles parsing, the meta-scope expansion (full → all writes), and the implicit-read rule.
• 14 write tools migrated from requires_full_access to requires_scope: 'write: '.
• Wizard step 2 rewritten as a scope-checkbox panel. Read is shown disabled+checked (always granted). Write rows are gated on mpai_use_mcp_write capability. The write:courses checkbox only renders when MemberPress Courses is active.
• Wizard step 2 now honors the Default Access Level setting from MCP Settings, when admin has set the default to "Full Access," all write checkboxes start pre-checked (still gated on mpai_use_mcp_write). Previously the new checkbox panel ignored the setting and always opened with everything unchecked, so every new connection was issued read-only regardless of the configured default.
• Wizard step 4 ("You're All Set!") now displays the actual scope CSV in human-readable form, Read Only, Full Access, or e.g. Read + Manage members, Billing operations, instead of the legacy two-state label that always collapsed granular scopes to "Read Only".
• Connected Clients table renders multi-scope tokens as colored chips (read neutral, write:* blue, write:billing/imports amber for high-impact buckets).
• Test_ConfirmationTokens (11 tests), issue/verify, args mismatch, tool mismatch, user mismatch, single-use, replay-after-mismatch, empty token, arg-order canonicalization, protocol-field stripping, concurrent-issue uniqueness.
• Test_Scopes (11 tests), drives the real ScopeMatcher, locks down vocabulary constants and meta-scope semantics. Earlier mirror-test pattern caught and replaced.
• Test_RequiresConfirmation (9 tests), locks down the destructive-tool exception list, including fail-safe behavior when the action arg is missing.
• Existing tokens (read or full) keep working without migration. New tokens issued by the wizard will carry granular CSV scopes.
• For best confirmation-token atomicity under concurrent load, run with a persistent object cache (Redis or Memcached). Transient backend works on basic installs but the single-use property is best-effort there.
• Validates member + product, refuses duplicate enrollment
• Branches on one-time vs. recurring products (creates MeprSubscription only when needed)
• Always uses gateway='manual', admin-granted access, not a billing event
• Required scope: write:members. Required capability: edit_users
• Inherits Measure B (preview by default; execute: true to run live)
• Fires mpai_before_create_subscription filter and mpai_subscription_created action for extension
• Welcome fires last in the import row, after wp_insert_user + MeprUser->store + optional auto-subscribe, so the user lands in their inbox to a fully-provisioned account.
• Skipped on dry_run previews and on rows that fail validation.
• Existing users matched by email aren't re-created, so no duplicate notifications.
• Calls wp_delete_user($member_id) and lets MemberPress's deleted_user hook chain cascade-clean the mepr_members row, transactions, subscriptions, and events.
• Refuses to delete the calling user (self_delete_refused, would terminate their session) or any user holding manage_options (admin_delete_refused). Both checks fire before any state mutation.
• Required scope: write:members. Required capability: delete_users. destructiveHint: true so Measure A's confirmation gate is automatic.

Melhoria

• OAuth redirect URI allowlist now uses prefix matching for claude.ai/claude.com hosts. Previously v1.2.1 added a second hard-coded path (/api/mcp/oauth-redirect) to fix the cloud connector flow, but pinning to specific paths is brittle, any future Claude.ai redirect path change would break the integration again. Now any path under /api/mcp/* is accepted for claude.ai/claude.com hosts. Future-proofs against path changes; the host check is the security boundary.

Melhoria

• Settings save form refactored to use new FormData(form), the admin JS now submits the entire form element instead of hand-collecting individual field values. Adding new settings to the page only requires updating PHP and the template, no JS changes needed. Prevents the bug class that caused v1.1.3 (silently dropping new fields).

Melhoria

• Curated public tools:: memberpress_list_memberships, publicly-available plans with pricing and signup URLs; memberpress_get_membership, single plan details; memberpress_list_courses, public courses (when MP Courses is active); memberpress_get_course, single course preview
• Admin opt-in toggle in MemberPress → AI Settings → MCP Settings: "Enable public AI catalog endpoint". Default OFF, when off, the route returns 404.
• Per-product opt-out meta box on memberpressproduct and mpcs-course edit screens: "Show in public AI catalog". Default checked.
• MembershipFormatter::public_detail and CourseFormatter::public_detail, public-safe formatters that strip internal fields (member counts, access rules, custom meta) and add public signup URLs.

Melhoria

• Tools/list now filters by capability, users only see tools they can actually call. AI clients no longer suggest tools that fail mid-conversation. The visible toolset varies per user based on their scope and WP capabilities.
• Sensitive read tools now require WordPress capabilities (PII, financial data, admin config). 27 read tools gated: list_users, list_members, list_course_students, export_members, member_engagement; edit_users, get_member, get_protected_content, check_access, get_student_progress; manage_options, get/list_subscription, get/list_transaction, get_system_info, all reports (revenue, churn, membership_stats), all AI analysis tools (cohort, ltv, renewal_forecast, failed_payment, content_performance…
• A Subscriber with mpai_use_mcp now sees only public catalog tools (memberships, courses, lessons, rules, protected_urls). They can no longer enumerate members, view financials, or run reports.
• An Editor sees PII-related tools they can already access in WP admin (member info, course students) but no financial data.
• An Admin sees everything.

Melhoria

• Wizard's "Full Access" option is now gated on mpai_use_mcp_write instead of mpai_manage_mcp, admins still get it by default, and site owners can grant write-via-MCP without granting full settings-admin rights
• Token creation downgrades full → read for users without mpai_use_mcp_write